Unable to onboard machine from on premise to Azure Arc using Arc private link scope

Question

Unable to onboard machine from on premise to Azure Arc using Arc private link scope

Ajit Sane 0

Hello,

I am trying to onboard a machine from on premise to Azure Arc using private link scope. I have followed the recommendations from MS to setup things.

At on premise we have an environment connected to Azure via Azure Sit to site VPN, we have a dns forwarder configured for forwarding the requests for below domains to dns forwarder at the Azure end.

his.arc.azure.com

guestconfiguration.azure.com

dp.kubernetesconfiguration.azure.com

A dns forwarder on the Azure end is configured to forward these requests to Azure dns(168.63.129.16).

On the Azure, we have private link scope setup with private endpoint and dns zones.

Dns setup is working fine, from onpremise machine above domains resolves to private ip addresses.

But when running the onboarding script, getting below errors.

msg="AZCM0081: Failed to Get MSI Certificate from HIS"

msg="failed to retrieve MSI cert: 403 Forbidden{"error":{"code":"HCRP403","message":"Access to the specified resource from Public Internet is disallowed.

Note: Tried with and without proxy enabled on the machine, both failed.

Please let us know is there any additional setup required to resolve the issue.

Suchitra Suregaunkar 4,210 Reputation points Microsoft External Staff Moderator

2025-12-12T17:05:35.4066667+00:00
Hello Ajit Sane

You are onboarding an on‑prem server to Azure Arc using a Private Link Scope, DNS is resolving correctly to private IPs, but onboarding fails with:

AZCM0081: Failed to Get MSI Certificate from HIS

failed to retrieve MSI cert: 403 Forbidden {"code":"HCRP403","message":"Access to the specified resource from Public Internet is disallowed"}

This error indicates the Arc agent is still attempting to reach the HIS/MSI identity endpoints over the public path, even though Private Link is configured.

Microsoft has documented a known issue where Arc onboarding scripts generated from the Azure Portal do NOT automatically include the required Arc proxy‑bypass configuration when:

Private Link Scope is used

Proxy is used or not used

Because of this missing line, the Azure Connected Machine Agent tries to contact public HIS endpoints, triggering the exact 403 Forbidden (HCRP403) MSI certificate failure you are seeing.

This is not a DNS or VPN issue—your DNS is resolving correctly.

You must edit the onboarding script and add the missing Arc proxy‑bypass configuration before the azcmagent connect command.

Add this line:

& "$env:ProgramW6432\AzureConnectedMachineAgent\azcmagent.exe" config set proxy.bypass "Arc"

Once added, the agent correctly uses the Private Link Scope and stops calling public HIS endpoints.

The issue is caused because proxy bypass configuration is not added automatically when Private Link Scope is enabled.

Engineering team is updating the portal to support this, but no ETA yet.

Until then, customers must manually add the bypass line in the script.

Reference: https://dori-uw-1.kuma-moon.com/en-us/azure/azure-arc/servers/private-link-security

Thanks,

Suchitra.

1 answer

Your answer

Suchitra Suregaunkar 4,210 Reputation points Microsoft External Staff Moderator

2025-12-12T17:05:35.4066667+00:00

Hello Ajit Sane

You are onboarding an on‑prem server to Azure Arc using a Private Link Scope, DNS is resolving correctly to private IPs, but onboarding fails with:

AZCM0081: Failed to Get MSI Certificate from HIS

failed to retrieve MSI cert: 403 Forbidden {"code":"HCRP403","message":"Access to the specified resource from Public Internet is disallowed"}

This error indicates the Arc agent is still attempting to reach the HIS/MSI identity endpoints over the public path, even though Private Link is configured.

Microsoft has documented a known issue where Arc onboarding scripts generated from the Azure Portal do NOT automatically include the required Arc proxy‑bypass configuration when:

Private Link Scope is used

Proxy is used or not used

Because of this missing line, the Azure Connected Machine Agent tries to contact public HIS endpoints, triggering the exact 403 Forbidden (HCRP403) MSI certificate failure you are seeing.

This is not a DNS or VPN issue—your DNS is resolving correctly.

You must edit the onboarding script and add the missing Arc proxy‑bypass configuration before the azcmagent connect command.

Add this line:

& "$env:ProgramW6432\AzureConnectedMachineAgent\azcmagent.exe" config set proxy.bypass "Arc"

Once added, the agent correctly uses the Private Link Scope and stops calling public HIS endpoints.

The issue is caused because proxy bypass configuration is not added automatically when Private Link Scope is enabled.

Engineering team is updating the portal to support this, but no ETA yet.

Until then, customers must manually add the bypass line in the script.

Reference: https://dori-uw-1.kuma-moon.com/en-us/azure/azure-arc/servers/private-link-security

Thanks,

Suchitra.

Answer 1

It seems that you are encountering issues with onboarding your machine to Azure Arc using a private link scope, specifically with the error messages related to accessing the Managed Service Identity (MSI) certificate. Here are some troubleshooting steps you can consider:

Check Firewall Rules: Ensure that your local network firewall allows outbound traffic to the necessary Azure services. You need to confirm that you have added the Microsoft Entra ID and Resource Manager service tags to your local network firewall. This is essential for the agent to communicate with these services over the internet until private endpoints are fully operational.
DNS Configuration: Since you mentioned that DNS resolution is working fine and resolves to private IP addresses, double-check that the DNS configuration is correctly set up for all required domains. You can use the nslookup command to ensure that the domains resolve correctly to the private IPs.
```
   nslookup gbl.his.arc.azure.com
   nslookup agentserviceapi.guestconfiguration.azure.com
```
MSI Access: The error "403 Forbidden" indicates that access to the specified resource from the public internet is disallowed. Make sure that the Azure resources you are trying to access allow connections from your private link scope. You might need to review the permissions and access policies associated with the Managed Identity.
Proxy Settings: Since you mentioned trying with and without proxy enabled, ensure that the proxy settings are correctly configured if you are using a proxy. Sometimes, incorrect proxy settings can lead to connectivity issues.
Review Azure Private Endpoint Configuration: Ensure that the private endpoint is correctly associated with the Azure Arc private link scope and that it is configured to allow traffic from your on-premises network.

If the issue persists after checking these configurations, you may want to consult the Azure documentation for further troubleshooting steps or reach out to Azure support for more specific assistance.

References:

Share via

Unable to onboard machine from on premise to Azure Arc using Arc private link scope

1 answer

Your answer